import { createLockVault, createMemoryAdapter } from 'lockvault';

const auth = createLockVault({
  jwt: { accessTokenSecret: process.env.JWT_SECRET! },
  adapter: createMemoryAdapter(), // swap for Postgres/MongoDB/Redis in production
});

await auth.initialize();

// Log a user in — returns JWT tokens + a session
const { tokens, session } = await auth.login('user-123');

// Verify a token on any request
const payload = await auth.jwt.verifyAccessToken(tokens.accessToken);
console.log(payload.sub); // 'user-123'

// Refresh when the access token expires
const newTokens = await auth.refresh(tokens.refreshToken);

// Log out (revokes the token and session)
await auth.logout(tokens.accessToken);

import { createLockVault, createMemoryAdapter } from 'lockvault';
import type { LockVaultConfig } from 'lockvault';

const config: LockVaultConfig = {

  // ── JWT Settings (required) ──────────────────────────────────────────
  jwt: {
    algorithm: 'HS256',              // 'HS256' | 'RS256' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA'
    accessTokenSecret: '...',        // min 32 chars for HS256 (not needed for asymmetric)
    refreshTokenSecret: '...',       // optional — defaults to accessTokenSecret
    accessTokenTTL: 900,             // seconds (default: 15 minutes)
    refreshTokenTTL: 604800,         // seconds (default: 7 days)
    issuer: 'my-app',               // optional — validated on verify if set
    audience: 'my-api',             // optional — validated on verify if set
    privateKey: '...',              // PEM string — required for RS256/ES256/ES384/ES512/EdDSA
    publicKey: '...',               // PEM string — required for RS256/ES256/ES384/ES512/EdDSA
  },

  // ── Session Settings ─────────────────────────────────────────────────
  session: {
    enabled: true,                   // default: true
    maxPerUser: 10,                  // max concurrent sessions per user
    inactivityTimeout: 7200,         // seconds — revoke after 2h of no activity
  },

  // ── Refresh Token Security ───────────────────────────────────────────
  refreshToken: {
    rotation: true,                  // new refresh token on every refresh (default: true)
    reuseDetection: true,            // detect stolen tokens (default: true)
    familyRevocationOnReuse: true,   // revoke ALL tokens if theft detected (default: true)
    encryption: {                    // optional — encrypt refresh tokens with AES-256-GCM
      enabled: true,
      key: '...',                    // 64-char hex string (= 32 bytes)
    },
  },

  // ── TOTP / 2FA ───────────────────────────────────────────────────────
  totp: {
    issuer: 'MyApp',                 // shows in authenticator apps
    algorithm: 'SHA1',               // 'SHA1' | 'SHA256' | 'SHA512'
    digits: 6,                       // code length
    period: 30,                      // seconds per code
    window: 1,                       // accept ±1 time step
  },

  // ── OAuth ────────────────────────────────────────────────────────────
  oauth: {
    providers: {},                   // configured via registerPreset/registerProvider
    stateStore: myRedisKvStore,      // optional — for multi-instance deployments
  },

  // ── Key-Value Store ──────────────────────────────────────────────────
  kvStore: myRedisKvStore,           // optional — for TOTP replay protection in multi-instance

  // ── Database Adapter (required) ──────────────────────────────────────
  adapter: createMemoryAdapter(),

  // ── Plugins ──────────────────────────────────────────────────────────
  plugins: [],
};

const auth = createLockVault(config);
await auth.initialize();

import { generateKeyPairSync } from 'node:crypto';

// Generate a key pair (do this once, store the PEM strings in env vars)
const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
  publicKeyEncoding: { type: 'spki', format: 'pem' },
});

const auth = createLockVault({
  jwt: {
    algorithm: 'EdDSA',
    accessTokenSecret: '',       // not used for asymmetric algorithms
    privateKey,                  // signs tokens
    publicKey,                   // verifies tokens (safe to share)
  },
  adapter: createMemoryAdapter(),
});

const { privateKey, publicKey } = generateKeyPairSync('ec', {
  namedCurve: 'prime256v1',
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
  publicKeyEncoding: { type: 'spki', format: 'pem' },
});

const auth = createLockVault({
  jwt: { algorithm: 'ES256', accessTokenSecret: '', privateKey, publicKey },
  adapter: createMemoryAdapter(),
});

const { tokens } = await auth.login('user-123', {
  customClaims: { roles: ['admin'], orgId: 'org-456' },
});

// Later, when verifying:
const payload = await auth.jwt.verifyAccessToken(tokens.accessToken);
console.log(payload.roles); // ['admin']

// Normal flow:
const newTokens = await auth.refresh(tokens.refreshToken);
// ✓ Returns new access + refresh tokens

// Attacker replays the old refresh token:
await auth.refresh(tokens.refreshToken);
// ✗ Throws RefreshTokenReuseError — entire family revoked

auth.rotateJWTKeys('new-secret-at-least-32-characters-long!');
// New tokens use the new key
// Old tokens still verify against the previous key (up to 3 old keys kept)

// Get all active sessions for a user
const sessions = await auth.sessions.getUserSessions('user-123');

// Each session contains:
// { id, userId, deviceInfo, ipAddress, createdAt, expiresAt, lastActiveAt }

// Log in with device info
const { tokens, session } = await auth.login('user-123', {
  deviceInfo: { userAgent: req.headers['user-agent'], deviceType: 'mobile' },
  ipAddress: req.ip,
});

// Revoke a specific session (e.g., "log out my phone")
await auth.sessions.revokeSession(session.id);

// Log out everywhere
await auth.logoutAll('user-123');

// On login, attach any fields you want
const { session } = await auth.login('user-123', {
  attributes: {
    tenantId: 42,
    role: 'admin',
    region: 'us-east-1',
  },
});

session.tenantId; // 42
session.role;     // 'admin'

// Or update later
await auth.sessions.updateAttributes(session.id, { role: 'super-admin' });

// Step 1: Generate a secret and otpauth URI
const setup = await auth.setupTOTP('user-123', 'user@example.com');
// Returns: { secret, uri, backupCodes }

// Step 2: Show the user a QR code (use any QR library)
import QRCode from 'qrcode';   // npm install qrcode
const qrDataUrl = await QRCode.toDataURL(setup.uri);
// Display qrDataUrl as an <img> for the user to scan

// Step 3: User scans QR, types the 6-digit code to confirm
await auth.confirmTOTP('user-123', setup.secret, userEnteredCode, setup.backupCodes);
// 2FA is now active for this user

// Step 4: On future logins, verify the code
await auth.verifyTOTP('user-123', code);

// Disable 2FA
await auth.disableTOTP('user-123');

const remaining = await auth.totp.getBackupCodesCount('user-123');
const newCodes = await auth.totp.regenerateBackupCodes('user-123');

auth.registerOAuthPreset('google', {
  clientId: process.env.GOOGLE_CLIENT_ID!,
  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
  redirectUri: 'https://myapp.com/auth/google/callback',
});

auth.registerOAuthPreset('github', {
  clientId: process.env.GITHUB_CLIENT_ID!,
  clientSecret: process.env.GITHUB_CLIENT_SECRET!,
  redirectUri: 'https://myapp.com/auth/github/callback',
});

// 1. Redirect the user to the provider's login page
app.get('/auth/google', async (req, res) => {
  const url = await auth.getOAuthAuthorizationUrl('google');
  res.redirect(url);
});

// 2. Handle the callback after the user logs in
app.get('/auth/google/callback', async (req, res) => {
  const { profile, tokens } = await auth.handleOAuthCallback(
    'google',
    req.query.code as string,
    req.query.state as string,
  );

  // profile = { id, email, name, avatar, raw }
  let userId = await auth.oauth.findUserByOAuth('google', profile.id);
  if (!userId) {
    userId = createUserInYourDB(profile);
    await auth.oauth.linkAccount(userId, 'google', profile, tokens);
  }

  const { tokens: authTokens } = await auth.login(userId);
  res.json(authTokens);
});

auth.registerOAuthProvider('gitlab', {
  clientId: '...',
  clientSecret: '...',
  redirectUri: 'https://myapp.com/auth/gitlab/callback',
  authorizationUrl: 'https://gitlab.com/oauth/authorize',
  tokenUrl: 'https://gitlab.com/oauth/token',
  userInfoUrl: 'https://gitlab.com/api/v4/user',
  scopes: ['read_user'],
  mapProfile: (data) => ({
    id: String(data.id),
    email: String(data.email ?? ''),
    name: String(data.name ?? ''),
    avatar: String(data.avatar_url ?? ''),
    raw: data,
  }),
});

import { Pool } from 'pg';
import { createPostgresAdapter } from 'lockvault/adapters/postgres';

const pool = new Pool({ connectionString: process.env.DATABASE_URL });
const adapter = createPostgresAdapter(pool, { tablePrefix: 'auth_' });

const auth = createLockVault({ jwt: { ... }, adapter });
await auth.initialize(); // creates tables and indexes automatically

import { MongoClient } from 'mongodb';
import { createMongoDBAdapter } from 'lockvault/adapters/mongodb';

const client = new MongoClient(process.env.MONGO_URL!);
const db = client.db('myapp');
const adapter = createMongoDBAdapter(db, { collectionPrefix: 'auth_' });

import Redis from 'ioredis';
import { createRedisAdapter } from 'lockvault/adapters/redis';

const redis = new Redis(process.env.REDIS_URL);
const adapter = createRedisAdapter(redis, { prefix: 'auth:' });
// Sessions and revoked tokens auto-expire via Redis TTL

import { createMemoryAdapter } from 'lockvault';
const adapter = createMemoryAdapter();

import type { DatabaseAdapter } from 'lockvault';

function createMyAdapter(): DatabaseAdapter {
  return {
    async createSession(session) { /* ... */ return session; },
    async getSession(id) { /* ... */ return null; },
    async getSessionsByUser(userId) { /* ... */ return []; },
    // ... see DatabaseAdapter interface for all required methods
  };
}

import { authenticate, authorize, csrfProtection, setAuthCookies, clearAuthCookies } from 'lockvault/middleware/express';

// Create the middleware
const authMiddleware = authenticate({
  jwtManager: auth.jwt,
  sessionManager: auth.sessions,  // optional — validates session too
});

// Protect a route
app.get('/api/me', authMiddleware, (req, res) => {
  res.json({ user: req.lockvault!.user });
});

// Role-based access
app.delete('/api/users/:id', authMiddleware, authorize('admin'), (req, res) => {
  // Only users with { roles: ['admin'] } in their token reach here
});

// Set auth cookies after login (httpOnly, secure, sameSite: lax)
app.post('/auth/login', async (req, res) => {
  const { tokens } = await auth.login(userId);
  setAuthCookies(res, tokens);
  res.json({ success: true });
});

import { lockVaultPlugin, fastifyAuthorize } from 'lockvault/middleware/fastify';

await app.register(lockVaultPlugin, {
  jwtManager: auth.jwt,
  sessionManager: auth.sessions,
  publicRoutes: ['/auth/login', '/auth/register', '/health'],
});

// Every non-public route is now protected automatically

app.get('/api/admin', {
  preHandler: [fastifyAuthorize('admin')],
}, async (req) => {
  return { user: req.lockvault!.user };
});

import { createRateLimiter, RateLimitError } from 'lockvault';

const loginLimiter = createRateLimiter({
  windowMs: 60_000,      // 1 minute window
  maxAttempts: 5,         // max 5 attempts per window
});

app.post('/auth/login', async (req, res) => {
  try {
    await loginLimiter.consume(req.ip);  // throws if over limit
    // ... do login ...
    loginLimiter.reset(req.ip);          // reset on success
  } catch (err) {
    if (err instanceof RateLimitError) {
      return res.status(429).json({
        error: err.message,
        retryAfterMs: err.retryAfterMs,
      });
    }
    throw err;
  }
});

import type { KeyValueStore } from 'lockvault';

// Example: Redis-backed store
function createRedisKeyValueStore(redis: Redis): KeyValueStore {
  return {
    async get(key) { return redis.get(key); },
    async set(key, value, ttlMs?) {
      if (ttlMs) await redis.set(key, value, 'PX', ttlMs);
      else await redis.set(key, value);
    },
    async delete(key) { return (await redis.del(key)) > 0; },
  };
}

const kvStore = createRedisKeyValueStore(redis);

const auth = createLockVault({
  jwt: { ... },
  adapter: postgresAdapter,
  kvStore,                        // TOTP replay protection across instances
  oauth: { providers: {}, stateStore: kvStore },  // OAuth state across instances
});

import type { LockVaultPlugin } from 'lockvault';

const auditPlugin: LockVaultPlugin = {
  name: 'audit-log',
  hooks: {
    afterTokenCreate: async (tokenPair) => {
      console.log('Token created:', tokenPair.accessTokenExpiresAt);
    },
    onReuseDetected: async (family, userId) => {
      await alertSecurityTeam(`Possible token theft for user ${userId}`);
    },
    onError: async (error, context) => {
      await logToSentry(error, { context });
    },
  },
};

const auth = createLockVault({ ...config, plugins: [auditPlugin] });

import { createEmailManager } from 'lockvault/email';

const mailer = createEmailManager({
  smtp: {
    host: 'smtp.gmail.com',
    port: 587,
    auth: { user: 'you@gmail.com', pass: 'app-password' },
    from: '"My App" <you@gmail.com>',
  },
  defaults: { appName: 'My App', supportUrl: 'https://myapp.com/support' },
});

// Plain text
await mailer.sendMail({ to: 'user@example.com', subject: 'Hello', text: 'Just checking in.' });

// HTML with attachments
await mailer.sendMail({
  to: ['alice@example.com', 'bob@example.com'],
  subject: 'Monthly Report',
  html: '<h1>Report</h1><p>See attachment.</p>',
  attachments: [{ filename: 'report.pdf', path: './report.pdf' }],
  priority: 'high',
});

// CC, BCC, custom from, headers
await mailer.sendMail({
  to: 'user@example.com',
  cc: ['manager@example.com'],
  from: '"Finance" <finance@myapp.com>',  // override default from
  subject: 'Payment Confirmation',
  html: '<p>Your payment of $299 has been received.</p>',
  headers: { 'X-Transaction-ID': 'txn_abc' },
});

await mailer.sendCustom({
  to: 'user@example.com',
  subject: 'Order #{{orderId}} Confirmed',
  html: `
    <p>Hi {{name}}, your order #{{orderId}} is confirmed.</p>
    {{#if trackingUrl}}<a href="{{trackingUrl}}">Track shipment</a>{{/if}}
    {{#each items}}<p>• {{name}} — {{price}}</p>{{/each}}
  `,
  variables: {
    name: 'Ayush',
    orderId: 'ORD-123',
    trackingUrl: 'https://track.example.com/ORD-123',
    items: [{ name: 'Widget', price: '$29.99' }],
  },
});

await mailer.sendForgotPassword('user@example.com', {
  resetUrl: 'https://app.com/reset?token=abc',
  expiresIn: '15 minutes',
  theme: 'friendly',  // or 'clean', 'secure'
});

await mailer.sendLoginNotification('user@example.com', {
  loginTime: new Date().toLocaleString(),
  ipAddress: '192.168.1.42',
  deviceInfo: 'Chrome on macOS',
  theme: 'vibrant',
});

await mailer.sendAlert('admin@example.com', {
  alertTitle: 'Failed Login Attempts',
  alertMessage: '15 failed attempts from IP 10.0.0.1.',
  severity: 'critical',
  theme: 'urgent',
});

// Inline HTML
mailer.registerNamedTemplate('order-shipped', {
  source: { type: 'html', content: '<p>Hi {{name}}, order #{{orderId}} shipped!</p>' },
  defaultSubject: 'Order #{{orderId}} Shipped',
});

// From a file on disk
mailer.registerNamedTemplate('welcome', {
  source: { type: 'file', path: './templates/welcome.html' },
  defaultSubject: 'Welcome to {{appName}}!',
});

// Custom render function (Handlebars, EJS, MJML, React Email, etc.)
mailer.registerNamedTemplate('newsletter', {
  source: { type: 'render', fn: (vars) => ejs.render(myTemplate, vars) },
  defaultSubject: '{{appName}} Newsletter',
});

// Send by name
await mailer.sendWithTemplate({
  to: 'user@example.com',
  template: 'order-shipped',
  variables: { name: 'Ayush', orderId: 'ORD-789' },
});

mailer.registerCategory('invoice', 'simple');
mailer.registerTemplate('invoice', 'simple', simpleInvoiceHtml);
mailer.registerTemplate('invoice', 'detailed', detailedInvoiceHtml);
mailer.setDefaultTheme('invoice', 'simple');

// Override built-in templates if you want
mailer.registerTemplate('login', 'minimal', myCustomLoginHtml);

// Remove templates/categories you don't need
mailer.removeTemplate('alert', 'subtle');
mailer.removeCategory('invoice');

import Handlebars from 'handlebars';

const mailer = createEmailManager({
  smtp: { /* ... */ },
  customRenderer: (html, vars) => Handlebars.compile(html)(vars),
});

const result = await mailer.sendBulk({
  subject: 'Your monthly summary',
  html: '<p>Hi {{name}}, you had {{count}} logins.</p>',
  recipients: [
    { to: 'alice@example.com', variables: { name: 'Alice', count: 42 } },
    { to: 'bob@example.com', variables: { name: 'Bob', count: 7 } },
  ],
  delayMs: 100, // 100ms between sends
});
// result = { total: 2, sent: 2, failed: 0, results: [...] }

// Preview a category+theme template
const html = mailer.preview('login', 'vibrant', { userName: 'Test', loginTime: 'now' });

// Preview a named template
const html2 = await mailer.previewNamedTemplate('order-shipped', { name: 'Test', orderId: 'DEMO' });

// Render inline template (no SMTP needed)
const html3 = mailer.renderInline('<p>Hi {{name}}</p>', { name: 'Ayush' });

// Verify SMTP connection
const ok = await mailer.verify();  // true or false

// List everything available
mailer.listCategories();        // ['login', 'forgot-password', 'alert', ...]
mailer.listThemes('login');     // ['minimal', 'corporate', 'vibrant']
mailer.listNamedTemplates();    // ['order-shipped', 'welcome', ...]

import { hashPassword, verifyPassword, generateId, generateUUID, generateBackupCodes } from 'lockvault';

// Password hashing (scrypt, N=16384, r=8, p=1)
const hash = await hashPassword('my-password');
const isValid = await verifyPassword('my-password', hash);  // true

// Random IDs
const id = generateId(32);     // 64-char hex string
const uuid = generateUUID();   // UUID v4

// Backup codes (48-bit entropy each)
const codes = generateBackupCodes(10);  // ['A1B2-C3D4-E5F6', ...]

import { LockVaultError, TokenExpiredError, RateLimitError } from 'lockvault';

try {
  await auth.jwt.verifyAccessToken(token);
} catch (err) {
  if (err instanceof TokenExpiredError) {
    // err.code === 'TOKEN_EXPIRED', err.statusCode === 401
  }
  if (err instanceof RateLimitError) {
    // err.code === 'RATE_LIMITED', err.statusCode === 429
    // err.retryAfterMs → milliseconds until retry is allowed
  }
  if (err instanceof LockVaultError) {
    res.status(err.statusCode).json({ error: err.message, code: err.code });
  }
}